Ethical Dilemma - Inexperienced Examiners - Discussion

Nothing. One day, a client will discover that their 'expert' is not qualified to be an expert and the market will take care of itself (no more business for that person).

On related topic, the internet has made being a student easier as posting questions online to be answered by experts, negates the student learning or doing their own homework. I'd guess that many of the basic questions are from students that would rather not do their homework and take advantage of others in the field. That type of forensic examiner need not be in the business…

I think that anyone who receives a response here from anyone and takes it as gospel doesn't "get it".

They completely overlook the basics of the scientific method - if they don't check out the offered answer(s) for themselves they do so at their peril.

Just my 2 cents.

I personally believe that from a moral and ethical perspective anyone who is giving a forensic service to a client without the sufficient knowledge should not be doing so unregulated, putting the forensic community as a whole in a bad light if and when their business fails (as frankyshells suggests).

Having said all this, aside from issues of they being no official governing body, how would you personally go about responding? Are you simply talking about educating those who lack knowledge (who are not forensic students) or something more?

However where the poster is clearly acting on a live case and shows such a lack of basic knowledge which can only put their client at risk how should the community respond?

I think the most positive would be in engaging with the poster. Perhaps their post makes them sound less experienced than they actually are, they might have tripped over some terminology or just simply cobbled a post together and not read it themselves. Or, it could be that they are vastly experienced in some areas but because the request sounds so trivial they come across as being inexperienced. A (unlikely) example might be someone who spends all their time examining unix servers then asks a seemingly straight forward question about the windows vista recycle bin. They probably have nt mentioned what they do day in and day out, so they just come across as inexperienced, they might not be. What about someone who normally examines crash dumps and volatile memory asking a simple question about NTFS ?

This probably isn't the case but sometimes you just don't know. The only way to tell is to find out more from them. I'm not sure at what point you say "you probably shouldn't be doing this case" …if ever ?

Nothing. One day, a client will discover that their 'expert' is not qualified to be an expert and the market will take care of itself (no more business for that person).

The consequences of a botched computer forensic investigation can be pretty severe; from huge financial loss (pensions funds, anyone?) to a murderer or rapist not being apprehended at the earliest possible opportunity. Harry raised this as an ethical question, and to leave such instances of bad practice to the market to correct is not only unethical but highly dangerous for the society in which these 'experts' work. As to the solution, that's not so clear cut. This issue must have raised itself in other fields though, so perhaps seeing how they have dealt with it would be a good place to start.

There's the solution. Regulation will come about due to the incompetence of examiners that take work that they knew not to have taken on in the first place.

No pity to the examiner that causes an innocent person to be convicted, a guilty person to go free, or an individual or company to suffer a great financial loss due to incompetence of the examiner.

I do disagree with it being ok for students to use forums as learning environments. It is usually very clear to see class questions being posted where a dozen answers are posted in reply. Just how many students do this, we'll never know, but I'm sure many replies were probably just cut and pasted into homework.

Part of the problem is exactly what you said
"I have in the past sat in concerned silence but not acted and I suspect I am not alone"

People all sit and say nothing and then when a person speaks out, they have no public support to speak out, only PM's and emails, but no one will say in public that someone is wrong and needs training. START speaking up and saying what's on your mind, people will learn and fix what's wrong or get another profession if enough people rate them as wrong or incompetent.

The mentality of some forum posters have to change also. If you notice when someone comments about training or questions a method, often other people who are inadequately trained run to that persons defense but the person questioning the methods or training gets little to no support.

I've posted about this before and was told to cut people slack, back off, etc.

There are tons of inexperienced examiners out there who take cases where someone's life is in the wings and they don't have a clue as to what they are doing.

I'd like to believe it is just a misunderstanding or poor wording of a question, but you see the same posters over and over "I just go this case and I need to know how to image a drive" "I need to know where to look if a USB device was hooked up"

[Removed by moderator]

There is not much anyone can do, except if you are a better investigator, pray that you get a case opposite that person and expose them. I've seen investigators from the private sector and a few from LE get ripped by Federal judges in their claim as experts and it made it into the record so that name is able to be searched forever. In the private sector, you have to just let them get one case against someone else who knows what they are doing and that could likely be the end of their career as we all know bad word of mouth travels very fast.

If they hold a certification, I would think that you could lodge a complaint with that organization as they seem to have rules and ethics and would not want to be held in a bad light by someone who claims to know what they are doing and really don't.

If a private person is inadequately trained it could cost a lot of money or it could make them miss something in the case which could have freed that person from incarceration. If someone in LE does it, they could be wrongfully charged and not be able to afford an expert and spent time in prison, either way it's no good.

I personally believe that from a moral and ethical perspective anyone who is giving a forensic service to a client without the sufficient knowledge should not be doing so unregulated, putting the forensic community as a whole in a bad light if and when their business fails (as frankyshells suggests).

In part I agree with the above. I think that it is past time that Computer Forensics as well as a whole host of other fields in the computing arena were not only regulated with an agreed standard of knowledge and parctice, but would take this a step further and consider licensing many fields in the computing arena.

This topic continues to raise its head within the BCS (I will state my case here, that I am unhappy with their proposed implementation and as a result have not pursued membership) and people continue to shy away from it for various reasons, but Harry poses an interesting dilemna.

I think we must all agree that there is no agreed standard for what makes a Computer Forensic Expert, indeed there is very little to prevent somebody who holds an ECDL, can type a word document and once repaired a computer using "Regedit" from being declared an expert witness in court (Is this a failing of the court or our failing for allowing it to happen because we have failed to grasp the mettle and introduce some form of agreed accreditation or licensing?).

Under a system of licensing, I would suggest that it would be a duty placed upon us to highlight the failings of another licensed individual (hopefully not as a form of witch hunt but rather that the individual could rectify the situation with either suitable training or amended practices) and further to highlight individuals practising without the required licence.

I have no doubt that this would cause a major shake-up in the field with many individuals who have been practising for years scrambling to obtain sufficient professional development points to be granted a licence, but it should significantly reduce the number of people who purport to be forensic professionals when they are clearly underqualified.

I suspect, though, that people will back off from licensing, many from fear of failing to gain accreditation, and it will be some years before the situation is resolved. I also suspect that if we don't implement some system of self-governance one will be imposed on us by some combination of central government, health and safety, human resources, merchant bankers and lawyers ….. I have sleeplesss nights!!

I have a feeling that this topic may run for a long time without anybody managing to find any common ground. Personally I think that this is a damning indictement on us and society as a whole.

The major learning experience in becoming an expert is wisdom about what you do not know. My observations are that some people never reach this stage and that some unfortunately work for companies that do not allow their staff to turn down work, so the ‘expert’ has to make the best of it.

Hence, I personally think it would be wrong to make judgements about the questions asked on a forum. In doing so you may only stifle the use of a forum to assist in a person’s ability to learn. Surely it is best such people ask the questions than to sit in silence not having any idea about the answers.

As soon as forum posts/comments are used as a basis of targeting another 'expert', it potentially becomes a very dangerous game.

Kind regards

Sam Raincock